Security reports should be made privately.

Please use GitHub's Private vulnerability reporting feature: open the Security tab of this repository and choose Report a vulnerability. The report stays visible to the maintainers only.

Include, where possible:

• affected package and version or commit;
• description of the vulnerability;
• reproducible steps or proof of concept;
• expected security impact;
• known mitigations or workarounds.

Never include a real credential.

Please do not open a public GitHub issue for an unpatched vulnerability.

KAITEN INC asks security researchers to provide a reasonable opportunity to investigate and address a vulnerability before public disclosure.

KAITEN INC will make reasonable efforts to acknowledge valid reports, assess their impact, coordinate remediation where appropriate, and publish relevant security information when a fix is available.

The latest release of each package. Fixes ship in a new release rather than as backports to older versions.

A credential that reached a browser bundle, a repository or a log is compromised whatever these packages do. Rotate it from the Kaiten console.

Unless a repository states otherwise, this policy covers Kaiten open-source projects maintained by KAITEN INC.

Third-party services, integrations, dependencies, and forks may have separate security reporting processes.